Manage how shop-floor endpoint agents authenticate to this server, build the agent for this site, and set what it reports and how often.
STORE YOUR KEY SECURELY. IT IS SHOWN ONLY ONCE AND CANNOT BE RECOVERED.
Before you generate a key, open the ShopDB Secure Send tool in a second window. As soon as the key appears, paste it into Secure Send, generate a secure link, and send that link to yourself in Teams so the site leader has a one-time, self-destructing backup. Never paste the raw key into a chat message or a plain file.
The endpoint agent reports with a single managed key scoped to endpoint telemetry only. It is separate from every other collector, so rotating or revoking it stops all endpoint-agent traffic immediately without touching the PC or GE-Enforce collectors.
Active key {{ key.tokenprefix }}...,
created {{ formatDate(key.createddate) }}.
Last used {{ formatDate(key.lastusedat) }}.
Not used yet.
No endpoint agent key is active. Generate one to let agents report with a managed credential.
On. The bootstrap COLLECTOR_API_KEY still authorizes endpoint reports. Generating a key turns this off so the managed key becomes the only credential. Off. Only the managed key above authorizes endpoint reports, so revoking it is an instant kill switch.
Anyone with this key can report as an endpoint agent for this site. Treat it like a password. If it is lost you must regenerate, which revokes the old key and forces every agent to be reconfigured.
Recommended: before you leave this page, open the ShopDB Secure Send tool in a second window, paste this key, generate a secure link, and send that link to yourself in Teams. That gives the site leader a one-time, self-destructing copy to fall back on instead of pasting the raw key into a chat or a file.
Configure it as the agent X-API-Key header value.
{{ secret }}
.env fallback so
the managed key becomes the only accepted credential. The full
secret is shown once - store it in the agent config as the
X-API-Key header.
Generate a one-shot, agentless enrollment tool. Run it once on a PC and it creates a ShopDB PC and Endpoint entry using only the collector key - no service, no polling, no ongoing telemetry. Use this for machines you want inventoried without running the full endpoint agent.
Paste a collector key below (generate one above first; the secret is only shown once). The key is embedded in the downloaded config and is not stored on the server.
{{ adoptmessage }}
{{ adopterror }}
Produce an instance-locked agent package stamped with this server's
URL, the endpoint agent key, and the reporting cadence, so it deploys
with no manual configuration on the client. The download includes the
agent, a non-secret appsettings.json, and an
install.ps1 that writes the credentials to the registry
(HKLM\SOFTWARE\GE\ShopDB) - the key never lands in
appsettings.
No agent binary is staged on this server. The package
will still build with config and installer, but you must drop
shopdbagent.exe beside them before deploying. Stage a
prebuilt agent under instance/siteagent/ to have it ship
in the download.
For a reverse-proxy or internal-CA server this app cannot see, upload
the server's public certificate (or issuing CA) in PEM format. It is
validated, bundled with the package, and imported into the endpoint's
Trusted Root store by install.ps1. Leave empty when the
server uses a publicly trusted certificate. An upload takes precedence
over the bundled server certificate above.
{{ agentmessage }}
{{ agenterror }}
Define what the agent collects and how often: reporting cadence, monitored processes and services, the curated Windows event list, and whether unknown hosts self-adopt on first contact. These settings are stamped into the build above so a deployed agent needs no local edits.
Monitored processes and services are defined as reusable monitors and attached to PC types through site policies, so a deployed agent fetches the right set for its type.